Quick answer

What this guide helps you do

Trace a full Ubuntu filesystem from blocks and inodes to large directories, logs, deleted-open files, Docker data and hidden mount-point contents.

Confirm which filesystem is full

df -hT
df -ih
findmnt
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINTS

A filesystem can run out of blocks or inodes. Identify the exact mount before deleting anything.

Measure top-level directories

Stay on the affected filesystem with the -x option:

sudo du -xhd1 / 2>/dev/null | sort -h
sudo du -xhd1 /var 2>/dev/null | sort -h

Drill into the largest directory one level at a time. This is safer than deleting from a guessed location.

Find large files

sudo find / -xdev -type f -size +1G -printf '%s %p\n' 2>/dev/null | sort -n

Review ownership and purpose. Large does not mean safe to delete.

Check journals and logs

journalctl --disk-usage
sudo du -sh /var/log/* 2>/dev/null | sort -h

Use journald retention settings and log rotation rather than deleting active log files blindly.

Find deleted files still held open

A process can keep consuming space after its file was deleted:

sudo lsof +L1

Restart or reload the owning service during a suitable window. Do not kill processes solely to reclaim space without understanding their role.

Inspect Docker separately

sudo docker system df -v
sudo du -xhd1 /var/lib/docker 2>/dev/null | sort -h
sudo docker ps -a --size

Prune only identified unused objects. Named volumes may contain irreplaceable data, and build caches can be expensive to recreate.

Check hidden data below a mount point

If files were written to /srv/data while its drive was absent, mounting the drive hides those root-filesystem files. Stop dependent services and inspect from a maintenance environment or bind-mount the parent filesystem safely. Do not unmount active production storage casually.

Verification checklist

  • The exact full filesystem is known.
  • Block and inode usage were checked.
  • Large directories were measured on that filesystem only.
  • Deleted-open files were checked.
  • Logs and Docker were inspected with their own tools.
  • Every deletion target was identified first.
  • Space was rechecked after the change.
  • Monitoring or retention prevents recurrence.

These commands diagnose usage; they do not label any individual file safe to remove.

Next: Share a Folder with Samba on Ubuntu Server. Return to Mount a Drive Automatically with fstab.

Official reference: Ubuntu Server storage and filesystems.